WO2004107650A1

WO2004107650A1 - A system and method of network authentication, authorization and accounting

Info

Publication number: WO2004107650A1
Application number: PCT/CN2003/001162
Authority: WO
Inventors: Fuyou Miao
Original assignee: Huawei Technologies Co., Ltd
Priority date: 2003-06-02
Filing date: 2003-12-31
Publication date: 2004-12-09
Also published as: CN1553368A; AU2003296236A1; CN100337229C; US7653933B2; US20080235770A1

Abstract

A system and method of network authentication, authorization and accounting, wherein the system comprises, a subscriber device, the subscriber establishes a connection with network through the subscriber device; an access server, it connects to the subscriber device, and makes the subscriber device connected to the network; an AAA server, it connects to the access server, and implements the subscriber authentication, authorization and accounting of accessing network together with the access server ; a service server , it connects to the access server, and provides specific services , and exchanges authentication and authorization information with the AAA server , exchanges service with the subscriber device ; a service accounting server , it connects to the service server , implements accounting of usage of subscriber service resource together with the service server , and at the same time, transmits the accounting data to the AAA server . And also, the present invention discloses a method of network authentication, authorization and accounting. The present invention only utilizes one subscriber log-on information (accounts/password), through the invention, the subscriber can access to various services of the network by authenticating the subscriber's identity only once, and it can account all together.

Description

Network authentication, authorization and accounting system and method

The present invention relates to network operation and management, and particularly to a network authentication, authorization, and accounting system and method.

Background technique

Since the birth of the network, authentication, authorization, and accounting (AAA) systems have become the basis for its operation. The use of various resources in the network requires authentication, authorization, and accounting. For management. among them:

Authentication is the confirmation of a user's identity when the user uses resources in the network system. In this process, identity information (such as username-password combination, biometrics, etc.) is obtained through interaction with the user, and then submitted to the authentication server (AAA server 3); the latter checks the identity information and user information stored in the database Check the processing, and then confirm whether the user identity is correct according to the processing result. For example, the GSM mobile communication system is able to identify the logos and subscriber logos of network terminal equipment in its network.

Authorization. A network system authorizes users to use their resources in a specific way. This process specifies the services and rights that an authenticated user can use after accessing the network, such as the IP address granted. Taking the GSM mobile communication system as an example, the legitimate users who have passed the authentication have the service authority (whether to open the international caller service, etc.) established by the user and the operator beforehand.

Accounting, the network system collects and records the user's use of network resources in order to charge users for resource usage fees, or for auditing and other purposes. Internet access service provider An ISP is taken as an example. The user's network access usage can be accurately recorded by traffic or time.

In order for a network user to be able to use the services provided on the network normally, he needs to have access to network resources (that is, network access facilities) and network services. Therefore, there are two levels of AAA. The network resource level is verified by the network access provider for users, accounting and authorization, and the network service level is provided by the service provider.

There are two types of services on the current network. The first type is general data services, such as Web access, FTP (File Transfer Protocol), and e-mail. These services are provided free of charge by service providers (receiving revenue through advertising or organization). Internal use). Correspondingly, for network access providers, the accounting mode is basically based on traffic, duration, or a combination of the two. User authentication is performed at the edge of the network through the network infrastructure provider.

The AAA facilities are completed without the problems of authentication, authorization and accounting for the business. This type of service generally has low requirements for the quality of service (QoS) of the network. The network can meet the requirements by forwarding data with the best effort transmission method. The coupling degree of the service to the network is low. The fee is sufficient. For service providers, the cost of providing the business can be reimbursed by collecting advertising costs, verifying the accounting at the place where the business is provided, or providing services to the organization.

The second type of services on the network are those that require quality of service (QoS) guarantees, such as IP Phone, NGN (Next Generation Network), video conferencing, Internet radio / TV, and VoD (Video on Demand). These services require the network to provide Different levels of QoS protection; otherwise, services cannot be developed normally. Because of the special requirements for network resources, the development of such services requires the cooperation of network access providers. At present, the basic mode of conducting such services on the Internet is to build Establish an independent network that only provides this type of service, and put the service and network access together, such as VoIP (Voice over IP).

At present, the AAA technology on the network basically uses the RADIUS protocol (Remote Dial-up User Access Protocol) as the back-end protocol (the protocol between Network Access Server (NAS) 2 and AAA Server 3), and the front-end protocol (User Equipment and AS Protocol) according to the access technology, such as the use of 802.1x in Ethernet and WLAN (Wireless Local Area Network). The current AAA framework structure is shown in Figure 1: When the access server 1 (that is, the NAS) receives a connection request from the user equipment 1, it encapsulates the request information into a protocol message supported by the AAA server 3 and sends it to the AAA server. 3. After multiple interactions between the user equipment 1 and the AAA server 3, the AAA server 3 sends an instruction to allow a legitimate user to the access server 2. In this way, the authorized user equipment 1 can access the network 4.

In the above solution, for the first type of service, the network itself cannot control the service itself, but can only control access. For type II services, the service access control is integrated with the access control. The access server 1 is both an EP (enhanced point, a device that performs access control) for network access, and an EP for service access. The types of services that can be carried out are limited, and if new second-type services need to be carried out on the network, the access server 2 and the AAA server 3 must be upgraded, as in the case of VoIP.

Another possible solution is that the service and network access are completely separated. The service provider and the network access provider have their own AAA server 3 and facilities, respectively. User authentication, authorization, and accounting are separated.

Because the network and services are completely separated, there are certain difficulties in guaranteeing QoS. In addition, users need to maintain multiple sets of identity information. There are also multiple AAA facilities on the network, which is convenient to use. Sexual damage. In particular, the network access provider and the service provider are not a unit, and the settlement is even more inconvenient.

Summary of the Invention

The problem solved by the present invention is to provide a network authentication, authorization and accounting system and method, which avoids the limitation of the existing network equipment, and at the same time guarantees the amount of service shield and facilitates accounting.

To solve the above problems, the network authentication, authorization, and accounting system of the present invention includes: user equipment, and the user establishes a connection with the network through the user equipment;

The access server is connected to the user equipment and connects the user equipment to the network; the AAA server is connected to the access server and completes user authentication, authorization, and accounting for accessing the network with the access server;

A business server, which is connected to the access server, provides specific services, and interacts with the AAA server to authenticate and authorize information, and exchanges business services with user equipment;

The business accounting server is connected to the business server, completes the accounting of the user's business resources with the business server, and sends the accounting data to the AAA server.

Among them, the access server can sense the quality of service, and the AAA server integrates the access accounting data and business accounting data.

In addition, the business accounting server and the AAA server are one device; the business server is a series of devices that complete a business and stores the service resource usage status records of the business server; the user device can be a computer, a mobile phone, a telephone, or a personal digital assistant.

Correspondingly, the network authentication, authorization and accounting method of the present invention includes the following steps: a network access request step, where a user logs in to a user equipment, and sends a network access request; b authentication and authorization steps, the AAA server and the access server according to user identity information After the user identity verification is completed, the corresponding user equipment is authorized or denied access to the network: c service access request step, the user equipment authorized to access the network sends a service access request to the service server, and the service access request includes the user identity information;

d Business confirmation and authorization steps. The business server queries the identification information stored in the AAA server through the business accounting server to confirm the user identity and corresponding business use rights. If the identification information matches the user identity information and corresponding business use rights, then The business server accepts the access request and authorizes the start of business interaction, otherwise the business service is rejected; e Business accounting step, the business server sends the user's business resource usage status record to the business accounting server, and the business accounting server Business Resource Usage Status) Brother records to get accounting data;

f The AAA server obtains the business accounting data and integrates it with the access accounting data. Compared with the prior art, the present invention has the following advantages:

1. The present invention separates the service server and the access server, which enables various service categories to be added on the network as needed, but does not require upgrading existing equipment on the network, which facilitates the development and deployment of services on the network;

2. Increase the business accounting server. Use of network resources and business resources are treated separately in accounting, and by providing a data channel between the AAA server and the business accounting server, the accounting result data is considered together. ;

3. Using only one user's login information (account / password), one identity verification can access various services on the network, and can be unified accounting, convenient for users to use the network and services; 4. It facilitates the network access provider's ability to control network services and provides accounting channels for QoS.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 Schematic diagram of the existing network authentication, authorization and accounting system.

FIG. 1 is a schematic diagram of a network authentication, authorization and accounting system according to the present invention.

FIG. 3 is a flowchart of a network authentication, authorization and accounting method according to the present invention.

FIG. 4 is a specific flowchart of FIG. 3.

FIG. 5 is a flowchart of adding services in the network authentication, authorization and accounting method of the present invention. detailed description

Please refer to FIG. 2, the network authentication, authorization and accounting system includes: user equipment 1, the user establishes a connection with the network through the user equipment, the user equipment 1 may be a computer, a mobile phone, a telephone, a PDA (personal digital assistant), etc. Equipment, the user equipment 1 may be connected to the network 4 by wireless or wired means / technology, such as GPRS (General Genwin Wireless System), ADSL (Asymmetric Data Subscriber Line), dial-up Internet access, WLAN, etc .;

The access server 2 is connected to the user equipment 1 and is a gateway capable of providing network access services for the user equipment 1 through wireless or wired means / technology, such as GPRS, ADSL, dial-up Internet access, WLAN, etc. The access server 2 does not You need to be aware of the business, but be able to be aware of QoS (quality of service). Whether the access server can sense the amount of service shield is a network characteristic, and the existing technology can be provided in various ways, which is not described repeatedly;

The AAA server 3 is connected to the access server 2 and completes, together with the access server 2, the user certificate, authorization, and accounting for accessing the network 4, and the access of the network 4; The service server 5 is a server that specifically provides services. It may also be a series of devices that collectively complete a service. It is connected to the access server 2 and can interact with the AAA server 3 for authentication and authorization information. It also exchanges business services with the user device 1. In addition, the service server 5 stores a service resource usage status record;

The business accounting server 6 is connected to the business server 5 and completes the accounting of the user's business resource together with the business server 5. At the same time, the accounting data is sent to the AAA server 3 in a regular / real-time manner, and the AAA server 3 is integrated The accounting data and the business accounting data are accessed. In addition, the business accounting server 6 and the AAA server 3 may be one device.

In the above system, when users apply for network access and related business services, they need to register first. The user enters login information (such as name, account number, password, etc.) from the user device 1 interface, and network 4 registers according to the user registration. Give users a legitimate access identity. Network 4 verifies user identity based on whether the user's identity information matches the identification information stored on the network to verify whether the user identity information includes login information and additional information about its attributes (such as identity ID, computer, location, access rights, etc. ). In this system, the authentication and accounting of network access are the same as the existing AAA mechanism and process.

In business access control, users must first present identity information, which may be in the form of PKC / AC (Public Key Certificate / Attribute Certificate), token, credential (Identity Certificate), etc. The AAA server 3 has been confirmed / verified at the time of entry. The service server 5 queries the AAA server 3 through the service accounting server 6 to confirm the user identity and authorization information, and access and authorize the use of the user's service.

Referring to FIG. 3 and FIG. 4, the network authentication, authorization and accounting method of the present invention includes the following steps: a network access request step 30, the user logs in to user equipment 1, and sends a network access request;

b. Step 31 of authentication and authorization. The AAA server 3 and the access server 2 complete user authentication based on the user identity information. The corresponding user equipment 1 is authorized or denied access to the network 4:

After receiving the access request, the access server 2 sends an authentication request to the AAA server 3. After the AAA server 3 verifies the identity of the user, it sends an authentication response to the access server 1. After receiving the authentication response, the access server 2 sends an access response to the user device 1. In response, the user equipment 1 is authorized or denied access to the network.

c Service access request step 32. When a user uses a service on the Internet, the user equipment 1 authorized to access the network sends a service access request to the service server 5 of the service, and the service access request includes user identity information. ;

d. Service confirmation and authorization step 33. The service server 5 queries the identification information stored in the AAA server 3 through the service accounting server 6 to confirm the user identity and corresponding service usage rights. If the identification information and user identity information and corresponding service use rights If they match, the service server 5 accepts the access request and authorizes the start of business interaction, otherwise it rejects the business service.

Among them, the service accounting server 6 can independently determine the service use right, but the user identity verification is still completed by the AAA server 3 finally.

In addition to the service access request / verification, the service confirmation and authorization steps may also include a service use request / verification, that is, to determine the specific authority of the user to use the service according to the status of the service resources and the identity of the user. e business accounting step 34, during the business interaction process or business interaction completed business server 5 sends the user's business resource usage status record to the business accounting server 6, the business accounting server 6 (with commonly used accounting software i.e. Yes) Calculate business expenses based on business resource usage status records, and get accounting data;

f The AAA server obtains business accounting data 35 and integrates access and business accounting data. The business accounting server 6 sends the accounting data to the AAA server 3 periodically or event-driven, or the AAA server 3 queries the business accounting server 6 periodically or event-driven to obtain the accounting data.

The network access provider, as the only interface to the user, negotiates business / network use and charging matters with the user, and can negotiate with the service provider on the use of accounting data and the way the cost is allocated. When the service providers are different, it is determined by the agreement between the AAA server 3 and the business accounting server. The accounting data passed by the business accounting server 6 to the AAA server 3 has a service type code. This accounting data should also include Service provider name / number, service resource usage, etc.

Referring to FIG. 5, a service provider adds a service when a new service is added. Step 50: According to the new service, the service provider constructs a service server 5 and a service accounting server 6 to provide business services. The service provider negotiates with the network access provider to determine the method of collecting accounting data and the method of dividing service revenue; b Step 51: Determine whether the service is the default service; if it is not the default service, the user applies to the service provider Business use, and store data (including user identification information and usage rights, user identity is the account assigned to the user by the network access provider) in the service accounting server 6, if it is the default service, it is provided to all users business; c Step 52, performing steps 30-35, the user uses the identity information (such as account number and password) for network access to access the network and uses the service (that is, the same ID is used for access and service access)

If other services are added, the same process (a-c) is also used, and the identity information (such as account number, password, etc.) used for access is also used to use the service (that is, multiple services use the same ID). In this way, using only one user's login information (account / password), a single authentication can access various services on the network, and can be unified accounting, which facilitates users to use the network and services.

Claims

Rights request

1. A network authentication, authorization and accounting system, comprising:

User equipment, where the user establishes a connection with the network through the user equipment;

It is characterized in that the system further comprises: a service server, connected to the access server, providing specific services, and interacting with the AAA server for authentication and authorization information, and exchanging business services with user equipment;

The business accounting server is connected to the business server, completes the accounting of the user's business resource usage with the business server, and sends the accounting data to the AAA server;

Among them, the access server can sense the quality of service, and the AAA server integrates access to accounting data and business accounting data.

2. The network authentication, authorization and accounting system according to claim 1, characterized in that the service server stores a service resource usage status record.

3. The network authentication, authorization and accounting system according to claim 1, wherein the service accounting server and the AAA server are one device.

4. The network authentication, authorization, and accounting system according to claim 1, wherein the service server is a series of devices that complete a service.

5. A network authentication, authorization and accounting method based on the system of claim 1, It is characterized in that the method includes the following steps:

a network access request step, the user logs in to the user device, and sends a network access request; b authentication and authorization steps, the AAA server and the access server complete the user identity verification based on the user identity information, and the corresponding user device is authorized or denied access to the network :

c service access request step, the user equipment authorized to access the network sends a service access request to the service server, and the service access request includes user identity information;

d. In the service confirmation and authorization step, the business server queries the identification information stored in the AAA server through the business accounting server to confirm the user identity and the corresponding service use authority. If the identification information matches the user identity information and the corresponding service use authority, The business server accepts the access request and authorizes the start of business interaction, otherwise it rejects the business service;

e business accounting step, the business server records the user's business resource usage status to the business accounting server, and the business accounting server obtains the accounting data according to the business resource usage status record;

f The AAA server obtains the business accounting data and integrates it with the access accounting data.

6. The network authentication, authorization and accounting method according to claim 5, wherein step b further comprises the following steps:

The access server receives the access request and sends an authentication request to the AAA server;

After the AAA server verifies the identity of the user, it sends a verification response to the access server. After the access server receives the verification response, it sends an access response to the user device. Authorized or denied access to the network.

7. The network authentication, authorization, and accounting method according to claim 5, wherein step d further comprises a service use request / verification, and determines the user's use of the service according to the status of the service resources and the identity of the user. Specific permissions.

8. The network authentication, authorization and accounting method according to claim 5, characterized in that the business accounting server in step f sends the business accounting data to the AAA server periodically or event-driven.

9. The network authentication, authorization and accounting method according to claim 5, characterized in that, in step f, the AAA server queries the business accounting server periodically or event-driven to obtain business accounting data.

The network authentication, authorization, and accounting method according to claim 5, wherein the method includes the following steps when adding a new service:

Service providers build business servers and business accounting servers based on new services to provide business services;

Determine whether the service is the default service. If it is the default service, it is provided to all users. If it is not the default service, the user applies for service use from the service provider and stores user identification information and use rights in Business accounting server

Steps a-f are performed, and the user uses the identity information for network access to access the network, uses the service to access the network, and uses the service.

The network authentication, authorization and accounting method according to any one of claims 5 to 10, wherein the user's identity information includes login information and attribute additional information, and the identity information is a public key certificate / attribute Presentation in the form of certificates, tokens, power of attorney.